Oracle PeopleSoft CVE-2026-60665

The attacker must have network access to the PeopleSoft Internet Architecture web front end over HTTP and must already hold low-level privileges (PR:L) - a valid authenticated PeopleSoft account, not anonymous internet access. Exploitation is further limited by High attack complexity (AC:H), meaning success depends on conditions outside the attacker's direct control or specialized knowledge rather than a simple repeatable request, and no user interaction is required (UI:N). The affected deployment must be Oracle PeopleSoft Enterprise HCM Global Payroll for Switzerland version 9.2 with the Global Payroll for Switzerland component in use. The authenticated foothold plus AC:H meaningfully constrain realistic exploitation despite the network attack vector.

The signals are mixed and should temper a purely score-driven response. The CVSS 3.1 base score of 8.2 is high, driven by high confidentiality and integrity impact plus a scope change, but attack complexity is High (AC:H) and the attacker must already hold low privileges (PR:L), so this is not a spray-and-pray internet exploit. No EPSS score was provided in the input, so exploitation probability cannot be quantified here. There is no public exploit identified at time of analysis and no CISA KEV listing, so there is no evidence of active exploitation; the 'Authentication Bypass' tag raises conceptual severity but is a vendor/aggregator label, not a confirmed exploit. Net: a genuine priority for organizations actually running PeopleSoft HCM Swiss payroll (payroll data is highly sensitive and the scope change broadens blast radius), but the AC:H and PR:L requirements make broad, low-effort exploitation unlikely. Note that the 'Authentication Bypass' tag partially conflicts with PR:L, which implies the attacker is already authenticated - treat the bypass characterization as unverified pending Oracle detail.

An attacker with a valid low-privilege PeopleSoft account - for example an internal user or a compromised self-service credential - sends crafted HTTP requests to the Global Payroll for Switzerland module and, by crossing the module's authorization boundary, gains read and write access to critical payroll data and adjacent PeopleSoft components. The high attack complexity means the attacker likely needs specific conditions or knowledge to succeed, and because no public exploit is identified at time of analysis, this would require original exploit development.